Security

Security logs and alerts help you to keep your Workplace community safe. Find out more about security by visiting the Customer Resource Center.

Workplace Logs are a hub for all security events and data. Below is a list of all the events we currently record, alongside an explanation of the event that's occurred.
Event NameNote
Logged inA user has successfully logged in using either password or SSO.
Login FailedA user has unsuccessfully tried to log in.
Logged outA user has logged out.
Password ChangedA user has changed their Workplace password.
Password Reset SucceededA user has reset their Workplace password by setting a new password.
Password Reset Code RequestedA user's Workplace password has been requested for reset through the self-service flow.
Password Reset Incorrect CodeThe verification code required to reset a user's Workplace password has been entered incorrectly.
Account at RiskWe've found a user whose account is at risk. See our article here on this prompt.
Account Set To UnclaimedAn admin or integration has set a user to unclaimed.
Forced LogoutAn admin has forced a user to log out via the admin panel.
Account DeactivatedA user has been deactivated through an admin or an integration.
Account ActivatedA user has been activated through an admin or an integration.
Account DeletedA user account has been deleted.
Forced Password ResetAn admin has forced a user's password to be reset before next login.
Account CreatedA user account has been created by an admin.
Accounts CreatedAn admin has created user accounts with the excel import method.
Admin Role ChangedAn admin account has had its role modified.
Admin RemovedA user account has had its admin role removed.
Admin CreatedA user account has been created through the "Administrators" section and has been promoted to an admin role.
Account Promoted to AdminAn existing user has been promoted to admin.
Email ChangedA user's email has been edited.
Domain AddedA domain has been added to the verification table, but has not been verified yet.
Domain VerifiedA domain has been verified successfully. See our article here for more information on domain verification.
Domain RemovedA domain has been removed from Workplace.
Two-Factor Authentication EnabledA user has self-enrolled in two-factor authentication. See our article here for more information on how this is enabled.
Two-Factor Authentication DisabledA user has disabled their two-factor authentication.
Phone Number AddedA user has added a phone number against their account.
Two-Factor Code Entry SucceededA user has successfully entered in their two-factor authentication code when prompted on our desktop or mobile site.
Two-Factor Code Entry FailedA user has unsuccessfully entered in their two-factor authentication code when prompted on our desktop or mobile site.
Two-Factor Code Entry Succeeded On Mobile AppA user has successfully entered in their two-factor authentication code when prompted on either our Android or iOS app.
Two-Factor Code Entry Failed On Mobile AppA user has unsuccessfully entered in their two-factor authentication code when prompted on either our Android or iOS app.
Group File DownloadedA file has been downloaded from a group.
Group File UploadedA file has been uploaded to a group. See our article here on how to upload a file to a group.
Malware Suspected in FileA file has been suspected of having malware and has been blocked from being uploaded to a group.
Integration CreatedA custom integration has been created.
Integration EditedA custom integration has been edited.
Integration DeletedA custom integration has been deleted.
Integration AddedAn app from the integration directory has been added.
Integration RemovedA integration directory app has been removed.
Multi-Company Group CreatedA multi-company group has been created.
Joined Multi-Company GroupA user has joined a multi-company group.
Created users via IDP SyncUsers have been created via a connected identity provider (Azure or G Suite).
Created Users via Coworker InviteUsers have been created through invites initiated by other community members.
Invited CoworkerUsers have been invited through invites initiated by other community members. They're only created once they accept the invite.
Compromised Credentials FoundAn account was found to have compromised credentials for Username/password authentication.
Company Marked as Resold
Malware Upload Blocked A malware found in a file upload was blocked.
Profile Data Download Requested A user put in a request to download their data.
Report Former Employee Persisted events from former employee reports. These are only persisted events for reports received by users of Workplace Essential.
Reseller Added
Reseller Invite Accepted
Reseller Invite Declined
Reseller Invite Sent
Reseller Removed
Self Invite Created A user created their account using self-invite.
SSO Reauthentication An admin requested SSO Reauthentication from their users.
Two-Factor Authentication Enabled Two-factor authentication was enabled for a user.
Two-Factor Code Entry Failed A two-factor authentication code entry failed upon validation.
Two-Factor Code Entry Failed On Mobile App A two-factor authentication code entry failed upon validation on the mobile app.
Two-Factor Code Entry Succeeded A two-factor authentication code entry succeeded upon validation.
Two-Factor Code Entry Succeeded On Mobile App A two-factor authentication code entry succeeded upon validation on mobile app.
User Invited A two-factor authentication code entry succeeded upon validation on the mobile app.
Integration Access Token Reset An integration access token was reset.
Profile Data Downloaded A user downloaded their data.
Two-Factor Authentication Disabled Two-factor authentication was disabled for an user.
Reported Content A user has reported a post for the admin to review.
Video Downloaded
Was this information helpful?
Admins can save the searches they make in the Security Log. To save a search:
  1. From your admin panel, click Security.
  2. Select the Log tab.
  3. Type in your search criteria and select Save Search.
  4. Saved Searches appear on the right side of the Log page.
Was this information helpful?
This article is only applicable to community admins on Workplace Advanced
If you've received a prompt that says a security risk has been detected, or the dashboard in your Security tab shows at risk accounts, this means that we suspect that the Workplace passwords of some of the user accounts in your community may be at risk. Given that there's a small risk that an attacker could use that information to access your Workplace community, we recommend that you disable these users or force them to reset their passwords.
To see which accounts may be at risk:
  1. Click Admin Panel at the top left of your home page.
  2. Click People.
Accounts that are at risk will be highlighted in red and labeled Account at Risk. To disable the user or force them to reset their password, click next to the account that's at risk and select Deactivate User or Force Password Reset.
Was this information helpful?
The Security tab in your Admin Panel gathers all the information regarding your community's security into one place, making it easier to access and oversee. The tab combines a Security Log and Authentication, and the dashboard provides you with an overview of your community's security activity.
To access the Security tab:
  1. Click Admin Panel at the top left of Workplace on your computer.
  2. Click the Security tab.
  3. From the dashboard, click the Log tab at the top of the page. From there, you can view all log in, password, admin, file and integration activity from the past 90 days.
The Authentication tab allows you to decide how members of your community can log in (ex. by password or SSO).

Was this information helpful?
The Security Health score takes into account various pieces of information about your community's security activities.
The overall security level is based on the security events of the last 30 days and the security features you've set up as well as any security threats we've detected. We'll notify you about issues that need your attention.

Was this information helpful?